Trojan.Hosts.46457

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\kangle] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\kangle] 'ImagePath' = '%ProgramFiles(x86)%\Bangteng\Kangle\bin\kangle.exe --ntsrv'

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop kangle

Modifies file system

Creates the following files

C:\ho\cj.asp
C:\llq\复件 (44) cs.htm
C:\llq\复件 (44) seyishi.crt
C:\llq\复件 (44) seyishi.key
C:\llq\复件 (45) ca15.cer
C:\llq\复件 (45) certutil.lnk
C:\llq\复件 (45) cs.htm
C:\llq\复件 (45) seyishi.crt
C:\llq\复件 (45) seyishi.key
C:\llq\复件 (46) ca15.cer
C:\llq\复件 (46) certutil.lnk
C:\llq\复件 (46) cs.htm
C:\llq\复件 (46) seyishi.crt
C:\llq\复件 (46) seyishi.key
C:\llq\复件 (47) ca15.cer
C:\llq\复件 (47) certutil.lnk
C:\llq\复件 (44) certutil.lnk
C:\llq\复件 (40) certutil.lnk
C:\llq\复件 (44) ca15.cer
C:\llq\复件 (43) seyishi.crt
C:\llq\复件 (40) seyishi.crt
C:\llq\复件 (40) seyishi.key
C:\llq\复件 (41) ca15.cer
C:\llq\复件 (41) certutil.lnk
C:\llq\复件 (41) cs.htm
C:\llq\复件 (41) seyishi.crt
C:\llq\复件 (41) seyishi.key
C:\llq\复件 (42) ca15.cer
C:\llq\复件 (42) certutil.lnk
C:\llq\复件 (42) cs.htm
C:\llq\复件 (42) seyishi.crt
C:\llq\复件 (42) seyishi.key
C:\llq\复件 (43) ca15.cer
C:\llq\复件 (43) certutil.lnk
C:\llq\复件 (43) cs.htm
C:\llq\复件 (43) seyishi.key
C:\llq\复件 (40) cs.htm
C:\llq\复件 (47) cs.htm
C:\llq\复件 (48) certutil.lnk
C:\llq\复件 (50) ca15.cer
C:\llq\复件 (50) certutil.lnk
C:\llq\复件 (50) cs.htm
C:\llq\复件 (50) seyishi.crt
C:\llq\复件 (50) seyishi.key
C:\llq\复件 (51) ca15.cer
C:\llq\复件 (36) certutil.lnk
C:\llq\复件 (51) certutil.lnk
C:\llq\复件 (51) seyishi.crt
C:\llq\复件 (51) seyishi.key
C:\llq\复件 (52) ca15.cer
C:\llq\复件 (52) certutil.lnk
C:\llq\复件 (52) cs.htm
C:\llq\复件 (52) seyishi.crt
C:\llq\复件 (5) 复件 seyishi.crt
C:\llq\复件 (5) 复件 seyishi.key
C:\llq\复件 (47) seyishi.key
C:\llq\复件 (47) seyishi.crt
C:\llq\复件 (5) 复件 ca15.cer
C:\llq\复件 (48) cs.htm
C:\llq\复件 (48) seyishi.crt
C:\llq\复件 (48) seyishi.key
C:\llq\复件 (49) ca15.cer
C:\llq\复件 (49) certutil.lnk
C:\llq\复件 (49) cs.htm
C:\llq\复件 (49) seyishi.crt
C:\llq\复件 (49) seyishi.key
C:\llq\复件 (5) ca15.cer
C:\llq\复件 (5) certutil.lnk
C:\llq\复件 (5) cs.htm
C:\llq\复件 (5) seyishi.crt
C:\llq\复件 (5) seyishi.key
C:\llq\复件 (5) 复件 certutil.lnk
C:\llq\复件 (48) ca15.cer
C:\llq\复件 (5) 复件 cs.htm
C:\llq\复件 (40) ca15.cer
C:\llq\复件 (4) 复件 seyishi.key
C:\llq\复件 (4) 复件 seyishi.crt
C:\llq\复件 (31) ca15.cer
C:\llq\复件 (31) certutil.lnk
C:\llq\复件 (31) cs.htm
C:\llq\复件 (31) seyishi.crt
C:\llq\复件 (31) seyishi.key
C:\llq\复件 (32) ca15.cer
C:\llq\复件 (32) certutil.lnk
C:\llq\复件 (32) cs.htm
C:\llq\复件 (32) seyishi.crt
C:\llq\复件 (32) seyishi.key
C:\llq\复件 (33) ca15.cer
C:\llq\复件 (33) certutil.lnk
C:\llq\复件 (33) cs.htm
C:\llq\复件 (33) seyishi.crt
C:\llq\复件 (30) seyishi.crt
C:\llq\复件 (33) seyishi.key
C:\llq\复件 (30) cs.htm
C:\llq\复件 (30) ca15.cer
C:\llq\复件 (29) ca15.cer
C:\llq\复件 (29) certutil.lnk
C:\llq\复件 (29) cs.htm
C:\llq\复件 (29) seyishi.crt
C:\llq\复件 (29) seyishi.key
C:\llq\复件 (3) ca15.cer
C:\llq\复件 (3) certutil.lnk
C:\llq\复件 (3) cs.htm
C:\llq\复件 (3) seyishi.crt
C:\llq\复件 (3) seyishi.key
C:\llq\复件 (3) 复件 ca15.cer
C:\llq\复件 (3) 复件 certutil.lnk
C:\llq\复件 (3) 复件 cs.htm
C:\llq\复件 (3) 复件 seyishi.crt
C:\llq\复件 (3) 复件 seyishi.key
C:\llq\复件 (30) certutil.lnk
C:\llq\复件 (34) ca15.cer
C:\llq\复件 (30) seyishi.key
C:\llq\复件 (34) certutil.lnk
C:\llq\复件 (38) seyishi.crt
C:\llq\复件 (39) ca15.cer
C:\llq\复件 (39) certutil.lnk
C:\llq\复件 (39) cs.htm
C:\llq\复件 (39) seyishi.crt
C:\llq\复件 (39) seyishi.key
C:\llq\复件 (4) ca15.cer
C:\llq\复件 (4) certutil.lnk
C:\llq\复件 (4) cs.htm
C:\llq\复件 (4) seyishi.crt
C:\llq\复件 (4) seyishi.key
C:\llq\复件 (4) 复件 ca15.cer
C:\llq\复件 (4) 复件 certutil.lnk
C:\llq\复件 (4) 复件 cs.htm
C:\llq\复件 (38) cs.htm
C:\llq\复件 (38) ca15.cer
C:\llq\复件 (38) seyishi.key
C:\llq\复件 (38) certutil.lnk
C:\llq\复件 (37) seyishi.key
C:\llq\复件 (34) cs.htm
C:\llq\复件 (34) seyishi.key
C:\llq\复件 (35) ca15.cer
C:\llq\复件 (35) certutil.lnk
C:\llq\复件 (35) cs.htm
C:\llq\复件 (35) seyishi.crt
C:\llq\复件 (35) seyishi.key
C:\llq\复件 (52) seyishi.key
C:\llq\复件 (51) cs.htm
C:\llq\复件 (36) ca15.cer
C:\llq\复件 (36) seyishi.crt
C:\llq\复件 (36) seyishi.key
C:\llq\复件 (37) ca15.cer
C:\llq\复件 (37) certutil.lnk
C:\llq\复件 (37) cs.htm
C:\llq\复件 (37) seyishi.crt
C:\llq\复件 (34) seyishi.crt
C:\llq\复件 (36) cs.htm
C:\llq\复件 (60) seyishi.key
%ProgramFiles(x86)%\bangteng\kangle\var\access.log
C:\llq\复件 (53) cs.htm
%ProgramFiles%\bangteng\kangle\etc\config.xml
%ProgramFiles(x86)%\bangteng\kangle\etc\config.xml
C:\youdao\pf\config.xml
%WINDIR%\certutil.log
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\error[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\error[1]
%WINDIR%\installer\fe287.msi
nul
%WINDIR%\installer\msie4aa.tmp
%TEMP%\cfge5b3.tmp
%WINDIR%\installer\msie5c4.tmp
%WINDIR%\installer\fe28a.ipi
%WINDIR%\installer\msie79a.tmp
C:\config.msi\fe28b.rbs
%ProgramFiles(x86)%\bangteng\kangle\bin\pcre.dll
C:\llq\复件复件 seyishi.key
C:\llq\复件 (7) 复件 seyishi.key
C:\llq\复件复件 seyishi.crt
C:\llq\复件复件 certutil.lnk
C:\llq\复件 (8) certutil.lnk
C:\llq\复件 (8) cs.htm
C:\llq\复件 (8) seyishi.crt
C:\llq\复件 (8) seyishi.key
C:\llq\复件 (9) ca15.cer
C:\llq\复件 (9) certutil.lnk
C:\llq\复件 (9) cs.htm
C:\llq\复件 (9) seyishi.crt
C:\llq\复件 (9) seyishi.key
C:\llq\复件 ca15.cer
C:\llq\复件 certutil.lnk
C:\llq\复件 cs.htm
C:\llq\复件 seyishi.crt
C:\llq\复件 seyishi.key
C:\llq\复件复件 ca15.cer
C:\llq\复件复件 cs.htm
C:\llq\复件 (8) ca15.cer
%WINDIR%\assembly\tmp\2pdl4n2u\netisapi.dll
%ProgramFiles(x86)%\bangteng\kangle\www\index.html
%WINDIR%\winsxs\installtemp\20190719010215376.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest
%ProgramFiles(x86)%\bangteng\kangle\bin\ssleay32.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\extworker.exe
%ProgramFiles(x86)%\bangteng\kangle\etc\lang.xml
%ProgramFiles(x86)%\bangteng\kangle\etc\lang_zh.xml
%WINDIR%\installer\fe28d.msi
C:\llq\复件 (53) ca15.cer
%ProgramFiles(x86)%\bangteng\kangle\var\kangle.pid
%WINDIR%\installer\msib06b.tmp
%TEMP%\cfgb131.tmp
%WINDIR%\installer\fe290.ipi
%WINDIR%\installer\msib1f3.tmp
C:\config.msi\fe291.rbs
<DRIVERS>\etc\h357.asp
%WINDIR%\winsxs\installtemp\20190719010215376.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat
%ProgramFiles(x86)%\bangteng\kangle\webadmin\core.whm
%ProgramFiles(x86)%\bangteng\kangle\bin\autoupdate.exe
%ProgramFiles(x86)%\bangteng\kangle\bin\netisapi.dll
%ProgramFiles(x86)%\bangteng\kangle\etc\lang_en.xml
%ProgramFiles(x86)%\bangteng\kangle\bin\libiconv2.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\kasp.dll
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcp90.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\sqlite3.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe
%WINDIR%\winsxs\installtemp\20190719010215501.0\9.0.21022.8.policy
%WINDIR%\winsxs\installtemp\20190719010215501.0\9.0.21022.8.cat
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcr90.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\zlib1.dll
%ProgramFiles(x86)%\bangteng\kangle\bin\libeay32.dll
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcm90.dll
%ProgramFiles(x86)%\bangteng\kangle\webadmin\logo.gif
%ProgramFiles(x86)%\bangteng\kangle\bin\webdav.dll
%ProgramFiles(x86)%\bangteng\kangle\.autoupdate.conf
%ProgramFiles(x86)%\bangteng\kangle\webadmin\kangle.css
%ProgramFiles(x86)%\bangteng\kangle\copyright.rtf
C:\llq\复件 (7) 复件 seyishi.crt
C:\llq\复件 (7) 复件 cs.htm
C:\llq\复件 (7) 复件 certutil.lnk
C:\llq\复件 (57) seyishi.crt
C:\llq\复件 (57) seyishi.key
C:\llq\复件 (58) ca15.cer
C:\llq\复件 (58) certutil.lnk
C:\llq\复件 (58) cs.htm
C:\llq\复件 (58) seyishi.crt
C:\llq\复件 (58) seyishi.key
C:\llq\复件 (59) ca15.cer
C:\llq\复件 (59) certutil.lnk
C:\llq\复件 (59) cs.htm
C:\llq\复件 (59) seyishi.crt
C:\llq\复件 (59) seyishi.key
C:\llq\复件 (6) ca15.cer
C:\llq\复件 (6) certutil.lnk
C:\llq\复件 (57) certutil.lnk
C:\llq\复件 (6) cs.htm
C:\llq\复件 (57) ca15.cer
C:\llq\复件 (56) seyishi.crt
C:\llq\复件 (53) seyishi.crt
C:\llq\复件 (53) seyishi.key
C:\llq\复件 (54) ca15.cer
C:\llq\复件 (54) certutil.lnk
C:\llq\复件 (54) cs.htm
C:\llq\复件 (54) seyishi.crt
C:\llq\复件 (54) seyishi.key
C:\llq\复件 (55) ca15.cer
C:\llq\复件 (55) certutil.lnk
C:\llq\复件 (55) cs.htm
C:\llq\复件 (55) seyishi.crt
C:\llq\复件 (55) seyishi.key
C:\llq\复件 (56) ca15.cer
C:\llq\复件 (56) certutil.lnk
C:\llq\复件 (56) cs.htm
C:\llq\复件 (56) seyishi.key
C:\llq\复件 (6) seyishi.crt
C:\llq\复件 (57) cs.htm
C:\llq\复件 (6) seyishi.key
C:\llq\复件 (63) certutil.lnk
C:\llq\复件 (63) seyishi.crt
C:\llq\复件 (63) seyishi.key
C:\llq\复件 (64) ca15.cer
C:\llq\复件 (64) certutil.lnk
C:\llq\复件 (64) cs.htm
C:\llq\复件 (64) seyishi.crt
C:\llq\复件 (64) seyishi.key
C:\llq\复件 (7) ca15.cer
C:\llq\复件 (7) certutil.lnk
C:\llq\复件 (7) cs.htm
C:\llq\复件 (7) seyishi.crt
C:\llq\复件 (7) seyishi.key
C:\llq\复件 (7) 复件 ca15.cer
C:\llq\复件 (63) ca15.cer
C:\llq\复件 (62) seyishi.crt
C:\llq\复件 (63) cs.htm
C:\llq\复件 (62) seyishi.key
C:\llq\复件 (62) cs.htm
C:\llq\复件 (6) 复件 ca15.cer
C:\llq\复件 (6) 复件 cs.htm
C:\llq\复件 (6) 复件 seyishi.crt
C:\llq\复件 (6) 复件 seyishi.key
C:\llq\复件 (60) ca15.cer
C:\llq\复件 (60) certutil.lnk
C:\llq\复件 (60) cs.htm
C:\llq\复件 (53) certutil.lnk
C:\llq\复件 (28) seyishi.key
C:\llq\复件 (60) seyishi.crt
C:\llq\复件 (61) certutil.lnk
C:\llq\复件 (61) cs.htm
C:\llq\复件 (61) seyishi.crt
C:\llq\复件 (61) seyishi.key
C:\llq\复件 (62) ca15.cer
C:\llq\复件 (62) certutil.lnk
C:\llq\复件 (6) 复件 certutil.lnk
C:\llq\复件 (61) ca15.cer
%ProgramFiles(x86)%\bangteng\kangle\var\server.log
C:\llq\复件 (28) seyishi.crt
C:\llq\复件 (26) seyishi.key
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
C:\llq\cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension3.db
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension4.db
C:\llq\cj\favorites\links\爱淘宝.url
C:\llq\复件 (11) cs.htm
C:\llq\复件 (11) seyishi.crt
C:\llq\复件 (11) seyishi.key
C:\llq\复件 (12) ca15.cer
C:\llq\复件 (12) certutil.lnk
C:\llq\复件 (12) cs.htm
C:\kl\certutilgl.lnk
C:\llq\复件 (12) seyishi.crt
C:\llq\复件 (13) ca15.cer
C:\llq\复件 (13) certutil.lnk
C:\llq\复件 (13) cs.htm
C:\llq\复件 (13) seyishi.crt
C:\llq\复件 (13) seyishi.key
C:\llq\复件 (14) ca15.cer
C:\llq\复件 (11) ca15.cer
C:\llq\复件 (11) certutil.lnk
C:\llq\cj\favorites\links\desktop.ini
C:\llq\cj\appdata\roaming\sogouexplorer\favorite3.dat
C:\llq\复件 (10) cs.htm
C:\llq\cj\favorites\links\百度.url
C:\llq\cj\favorites\links\网址大全.url
C:\llq\cj\favorites\links\聚划算.url
C:\llq\cj\favorites\天猫.url
C:\llq\cj\favorites\爱淘宝.url
C:\llq\cj\favorites\百度.url
C:\llq\cj\favorites\网址大全.url
C:\llq\cj\favorites\聚划算.url
C:\llq\cs.htm
C:\llq\seyishi.crt
C:\llq\seyishi.key
C:\llq\复件 (10) ca15.cer
C:\llq\复件 (10) certutil.lnk
C:\llq\复件 (10) seyishi.crt
C:\llq\cj\favorites\links\天猫.url
C:\llq\复件 (10) seyishi.key
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
C:\ho\复件 (4) cj.asp
C:\ho\复件 (5) cj.asp
C:\ho\复件 (6) cj.asp
C:\ho\复件 (7) cj.asp
C:\ho\复件 (8) cj.asp
C:\ho\复件 (9) cj.asp
C:\ho\复件 cj.asp
C:\ho\复件复件 cj.asp
C:\hos\h357.asp
C:\hos\hosts
C:\iifb\bd.html
C:\iifb\bd1.html
C:\iifb\gg.html
C:\iifb\gg2.html
C:\ho\复件 (3) cj.asp
C:\iifb\jj.html
C:\ho\复件 (25) cj.asp
C:\ho\复件 (23) cj.asp
C:\ho\复件 (10) cj.asp
C:\ho\复件 (11) cj.asp
C:\ho\复件 (12) cj.asp
C:\ho\复件 (13) cj.asp
C:\ho\复件 (14) cj.asp
C:\ho\复件 (15) cj.asp
C:\ho\复件 (16) cj.asp
C:\ho\复件 (17) cj.asp
C:\ho\复件 (18) cj.asp
C:\ho\复件 (19) cj.asp
C:\ho\复件 (2) cj.asp
C:\ho\复件 (2) 复件 cj.asp
C:\ho\复件 (20) cj.asp
C:\ho\复件 (21) cj.asp
C:\ho\复件 (22) cj.asp
C:\ho\复件 (24) cj.asp
C:\iifb\mm.html
C:\ho\复件 (3) 复件 cj.asp
C:\iifb\pc.html
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
C:\llq\cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
C:\llq\cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
C:\iifb\so360.html
C:\kl\1i4i5.bat
C:\kl\201906pc13.cmd
C:\kl\3msistub2.exe
C:\kl\apache.msi
C:\kl\ccc.cmd
C:\kl\certutil.lnk
C:\llq\复件 (14) certutil.lnk
C:\llq\复件 (12) seyishi.key
C:\kl\certutil11.exe
C:\kl\cj2.lnk
C:\kl\kl318kj.lnk
C:\llq\ca15.cer
C:\llq\certutil.lnk
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
C:\iifb\ss.html
C:\kl\cj.lnk
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\mark.js
C:\llq\复件 (28) certutil.lnk
C:\llq\复件 (14) seyishi.key
C:\llq\复件 (2) cj\favorites\百度.url
C:\llq\复件 (2) cj\favorites\网址大全.url
C:\llq\复件 (2) cj\favorites\聚划算.url
C:\llq\复件 (2) cs.htm
C:\llq\复件 (2) seyishi.crt
C:\llq\复件 (2) seyishi.key
C:\llq\复件 (2) 复件 ca15.cer
C:\llq\复件 (2) 复件 certutil.lnk
C:\llq\复件 (2) 复件 cs.htm
C:\llq\复件 (2) 复件 seyishi.crt
C:\llq\复件 (2) 复件 seyishi.key
C:\llq\复件 (20) ca15.cer
C:\llq\复件 (20) certutil.lnk
C:\llq\复件 (20) cs.htm
C:\llq\复件 (20) seyishi.crt
C:\llq\复件 (2) cj\favorites\爱淘宝.url
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
C:\llq\复件 (2) cj\favorites\天猫.url
C:\llq\复件 (2) cj\favorites\links\网址大全.url
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
C:\llq\复件 (2) cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension3.db
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\extension4.db
C:\llq\复件 (2) cj\appdata\roaming\sogouexplorer\favorite3.dat
C:\llq\复件 (2) cj\favorites\links\desktop.ini
C:\llq\复件 (2) cj\favorites\links\天猫.url
C:\llq\复件 (2) cj\favorites\links\爱淘宝.url
C:\llq\复件 (2) cj\favorites\links\百度.url
C:\llq\复件 (2) cj\favorites\links\聚划算.url
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
C:\llq\复件 (20) seyishi.key
C:\llq\复件 (21) seyishi.crt
C:\llq\复件 (25) cs.htm
C:\llq\复件 (25) seyishi.crt
C:\llq\复件 (25) seyishi.key
C:\llq\复件 (26) ca15.cer
C:\llq\复件 (26) certutil.lnk
C:\llq\复件 (26) cs.htm
C:\llq\复件 (14) cs.htm
C:\llq\复件 (26) seyishi.crt
C:\llq\复件 (27) ca15.cer
C:\llq\复件 (27) certutil.lnk
C:\llq\复件 (27) cs.htm
C:\llq\复件 (27) seyishi.crt
C:\llq\复件 (27) seyishi.key
C:\llq\复件 (28) ca15.cer
C:\llq\复件 (25) ca15.cer
C:\llq\复件 (25) certutil.lnk
C:\llq\复件 (21) certutil.lnk
C:\llq\复件 (21) ca15.cer
C:\llq\复件 (24) cs.htm
C:\llq\复件 (21) seyishi.key
C:\llq\复件 (22) ca15.cer
C:\llq\复件 (22) certutil.lnk
C:\llq\复件 (22) cs.htm
C:\llq\复件 (22) seyishi.crt
C:\llq\复件 (22) seyishi.key
C:\llq\复件 (23) ca15.cer
C:\llq\复件 (23) certutil.lnk
C:\llq\复件 (23) cs.htm
C:\llq\复件 (23) seyishi.crt
C:\llq\复件 (23) seyishi.key
C:\llq\复件 (24) ca15.cer
C:\llq\复件 (24) certutil.lnk
C:\llq\复件 (24) seyishi.crt
C:\llq\复件 (21) cs.htm
C:\llq\复件 (24) seyishi.key
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
C:\llq\复件 (19) ca15.cer
C:\llq\复件 (19) certutil.lnk
C:\llq\复件 (19) cs.htm
C:\llq\复件 (19) seyishi.crt
C:\llq\复件 (19) seyishi.key
C:\llq\复件 (2) ca15.cer
C:\llq\复件 (2) certutil.lnk
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
C:\llq\复件 (18) seyishi.crt
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
C:\llq\复件 (18) cs.htm
C:\llq\复件 (18) ca15.cer
C:\llq\复件 (15) ca15.cer
C:\llq\复件 (15) certutil.lnk
C:\llq\复件 (15) cs.htm
C:\llq\复件 (15) seyishi.crt
C:\llq\复件 (15) seyishi.key
C:\llq\复件 (16) ca15.cer
C:\llq\复件 (16) certutil.lnk
C:\llq\复件 (16) cs.htm
C:\llq\复件 (16) seyishi.crt
C:\llq\复件 (16) seyishi.key
C:\llq\复件 (17) ca15.cer
C:\llq\复件 (17) certutil.lnk
C:\llq\复件 (17) cs.htm
C:\llq\复件 (17) seyishi.crt
C:\llq\复件 (17) seyishi.key
C:\llq\复件 (18) certutil.lnk
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
C:\llq\复件 (18) seyishi.key
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
C:\llq\复件 (2) cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
C:\llq\复件 (2) cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
C:\llq\复件 (2) cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
C:\llq\复件 (2) cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
C:\llq\复件 (2) cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
C:\llq\复件 (14) seyishi.crt
C:\llq\复件 (28) cs.htm
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\content.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
C:\llq\复件 (2) cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
C:\llq\复件 (2) cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
<LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019071920190720\index.dat

Sets the 'hidden' attribute to the following files

C:\config.msi\fe28c.rbf

Deletes the following files

<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\error[1]
C:\kl\1i4i5.bat
C:\kl\certutil11.exe
C:\kl\3msistub2.exe
%WINDIR%\installer\fe290.ipi
C:\config.msi\fe291.rbs
%WINDIR%\installer\msib1f3.tmp
%WINDIR%\installer\msib06b.tmp
%WINDIR%\installer\fe28a.ipi
%WINDIR%\installer\fe287.msi
C:\config.msi\fe28b.rbs
C:\config.msi\fe28c.rbf
%WINDIR%\installer\msie79a.tmp
%WINDIR%\winsxs\installtemp\20190719010215376.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest
%WINDIR%\winsxs\installtemp\20190719010215376.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcr90.dll
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcp90.dll
%WINDIR%\winsxs\installtemp\20190719010215376.0\msvcm90.dll
%WINDIR%\winsxs\installtemp\20190719010215501.0\9.0.21022.8.policy
%WINDIR%\winsxs\installtemp\20190719010215501.0\9.0.21022.8.cat
%WINDIR%\installer\msie5c4.tmp
%WINDIR%\installer\msie4aa.tmp
C:\kl\apache.msi
C:\kl\201906pc13.cmd

Moves the following files

from %ProgramFiles(x86)%\bangteng\kangle\etc\config.xml to C:\config.msi\fe28c.rbf

Substitutes the following files

%ProgramFiles(x86)%\bangteng\kangle\etc\config.xml

Modifies the HOSTS file.

Deletes itself.

Network activity

TCP

HTTP GET requests

http://127.0.0.1/hos/h357.asp
http://127.0.0.1/ho/cj.asp
http://42.#zmkq.tw/bd/tj.asp
http://js.##ers.51.la/19391945.js
http://ia.#1.la/go1?id###########################################################################################################################################################################...
http://42.#dgkc.tw/bd/
http://www.mj##97.com/go/?dy

UDP

DNS ASK 42.#zmkq.tw
DNS ASK vi#.###gtaigroup.com
DNS ASK js.##ers.51.la
DNS ASK ia.#1.la
DNS ASK 42.#dgkc.tw
DNS ASK mj##97.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''

Creates and executes the following

'C:\kl\certutil11.exe' -addstore -enterprise "root" C:\llq\ca15.cer
'%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' --install
'%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' --ntsrv
'%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' "--shutdown" "12776" "--active" "12772" "--notice" "12768" "--worker_index" "0" "--ppid" "1844"
'C:\kl\3msistub2.exe' C:\kl\Apache.msi /quiet /norestart
'%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' "--shutdown" "12776" "--active" "12772" "--notice" "12768" "--worker_index" "0" "--ppid" "2408"
'%ProgramFiles(x86)%\bangteng\kangle\bin\extworker.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" h"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\1i4i5.bat" "
'%WINDIR%\syswow64\net1.exe' stop kangle
'%WINDIR%\syswow64\attrib.exe' <DRIVERS>\etc\hosts -h -r
'%WINDIR%\syswow64\cacls.exe' "<DRIVERS>\etc\hosts" /p everyone:f
'%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\Bangteng\Kangle\etc\config.xml" /p everyone:r
'%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\Bangteng\Kangle\etc\config.xml" /p everyone:r
'%WINDIR%\syswow64\cacls.exe' "C:\Youdao\pf\config.xml" /p everyone:r
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
'%WINDIR%\syswow64\find.exe' /i "zhs0816.com" "C:\Youdao\pf\config.xml"
'%WINDIR%\syswow64\xcopy.exe' /y C:\Youdao\pf "%ProgramFiles%\Bangteng\Kangle\etc" /e
'%WINDIR%\syswow64\xcopy.exe' /y C:\Youdao\pf "%ProgramFiles(x86)%\Bangteng\Kangle\etc" /e
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d"
'%WINDIR%\syswow64\msiexec.exe' -Embedding A05FDBE9DC29D061A824DFA533A538E9
'%WINDIR%\syswow64\msiexec.exe' /i C:\kl\Apache.msi /quiet /norestart
'%WINDIR%\syswow64\msiexec.exe' -Embedding B620CFB24E7D27CE1724C4C9B285F1BB
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n "240"
'%WINDIR%\syswow64\ping.exe' -n 2 localhost
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" h"
'%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\ccc.cmd"" h",0)(window.close)
'%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\201906pc13.cmd"" h",0)(window.close)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" "
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" "
'%WINDIR%\syswow64\msiexec.exe' /i C:\kl\Apache.msi /qn
'%WINDIR%\syswow64\net.exe' start kangle
'%WINDIR%\syswow64\net1.exe' start kangle

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial